{"id":"CVE-2026-110447","details":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","modified":"2026-10-15T10:30:24.964716907Z","published":"2026-10-14T02:27:42.315Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110447.json"},"references":[{"type":"WEB","url":"https://apps.nextcloud.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110447.json"},{"type":"ADVISORY","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447"},{"type":"REPORT","url":"https://github.com/CollaboraOnline/richdocumentscode/issues/354"},{"type":"PACKAGE","url":"https://github.com/CollaboraOnline/richdocumentscode"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/collaboraonline/richdocumentscode","events":[{"introduced":"0"},{"fixed":"e0221971cc3e0cf39db4672bef54ad60bab90486"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"fixed":"26.4.303"}]}}],"versions":["26.4.302","26.4.104","26.4.103","25.4.904","25.4.903","25.4.902","25.4.901","25.4.802","25.4.702","25.4.602","25.4.504","25.4.503","25.4.502","25.4.403","25.4.402","25.4.301","25.4.202","25.4.201","24.4.1303","24.4.1302","24.4.1204","24.4.1203","24.4.1102","24.4.1002","24.4.902","24.4.901","24.4.802","24.4.702","24.4.701","24.4.602","24.4.502","24.4.402","24.4.201","24.4.103","24.4.102","23.5.1001","23.5.904","23.5.705","23.5.702","23.5.604","23.5.602","23.5.601","23.5.503","23.5.502","23.5.403","23.5.501","23.5.402","23.5.401","23.5.301","23.5.202","23.5.104","23.5.103","23.5.102","23.5.5","23.5.4","22.5.1301","22.5.1201","22.5.1002","22.5.802","22.5.702","22.5.502","22.5.401","22.5.301","21.11.502","21.11.402","21.11.306","21.11.204","21.11.203","21.11.202","21.11.103","21.11.6","21.11.4","21.11.3","6.4.1303","6.4.1103","6.4.1004","6.4.1003","6.4.1002","6.4.806","6.4.705","6.4.704","6.4.703","6.4.702","6.4.608","6.4.607","6.4.606","6.4.601","6.4.503","6.4.403","6.4.303","6.4.302","6.4.301","6.4.203","6.4.202","6.4.14","6.4.13","6.4.013","6.4.011","6.4.010","6.4.009","6.4.007","6.4.003","4.2.800","4.2.602","4.2.407","4.2.406","4.2.405","4.2.404","4.2.403","4.2.402","4.2.401","4.2.400","4.2.301"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110447.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}